1. Data Controller
Pedrosa&Irmãos, Lda is responsible for the data processing carried out within the scope of its internal whistleblowing portal.

2. Confidentiality
Data processing is carried out confidentially, with access to personal data obtained through the portal limited to those responsible for receiving and monitoring complaints, as detailed in the Complaints Policy.

3. Basis of Treatment
Data processing is based on the need to comply with legal obligations, in particular those set out in Law No. 93/2021, of December 20, as well as the legitimate interests of Pedrosa&Irmãos, Lda in identifying and acting quickly and effectively against infringements committed in the course of its business.

4. Purpose of Data Processing
The personal data collected through the complaints portal is used exclusively to identify and investigate violations identified in the Complaints Policy.

5. Data Communication
In the context of investigating and managing complaints, Pedrosa&Irmãos, Lda may use third-party entities, namely lawyers/institutions and auditing or forensic expertise companies, to whom personal data may be communicated.

In any case, it is guaranteed that third-party entities with access to personal data comply with professional secrecy or confidentiality obligations and offer adequate implementation guarantees so that data processing meets the security requirements and protection of the rights of applicable data subjects.

Personal data may be processed by subcontractors, on behalf of and for the account of Pedrosa&Irmãos, Lda, namely IT service providers and suppliers of the software license used in the complaints portal.

Personal data may also be shared with third parties when (I) required by law; (II) determined by court order or public authority; or (III) the data subject gives their consent for this purpose.

6. Data Retention Period
Personal data processed within the internal complaints portal will be archived for a period of 5 years from the date the complaint is received or, in any case, for the duration of any judicial or administrative proceedings related to the complaint; after these periods, only a simplified and anonymous record of the respective complaint and the measures taken will remain on file for statistical purposes, and all personal data existing in the process will be deleted.

7. Data Subject Rights
Data subjects whose personal data is processed on the complaints portal have the rights of access, rectification, erasure, restriction of processing, portability, and objection. These rights can be exercised, provided the necessary requirements are met, by sending an email to the Data Protection Manager. It is also possible to file a complaint with the National Data Protection Commission.

8. Contact details for the Data Protection Officer
For any questions related to privacy or the protection of personal data, please contact us via email: geral@pedrosairmaos.com.